CVE-2017-10678: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack t...

Security readout for executives and security teams

CVE-2017-10678 is a CSRF flaw in Piwigo through 2.9.1. An attacker could trick a signed-in user into sending an unintended request that deletes permalinks. The business impact is content management disruption rather than direct server compromise, based on the provided sources. Exposure is likely limited to organizations running Piwigo through 2.9.1 with authenticated users who can delete permalinks. Publicly reachable admin or management workflows increase practical risk because CSRF depends on a victim already being authenticated. Treat as a moderate-priority maintenance and hardening item. It can disrupt website structure or navigation, but the provided evidence does not indicate code execution, data theft, or active exploitation. Mitigation focus: Identify all Piwigo deployments and their exact versions.; Check Piwigo issue 721 and the linked commit for vendor fix guidance.; Upgrade to a vendor-confirmed fixed Piwigo release when available..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.